CVE-2026-87128: Oracle Hyperion DRM Auth Bypass Vulnerability

CVE-2026-87128 Overview

CVE-2026-87128 is an authentication vulnerability [CWE-287] in the Access and Security component of Oracle Hyperion Data Relationship Management (DRM). Oracle disclosed the issue in a security alert covering DRM version 11.2.26.0.000. An unauthenticated attacker with network access over HTTP can compromise the application without user interaction. Successful exploitation allows attackers to read, create, modify, or delete any data accessible to Oracle Hyperion DRM. Oracle rates the flaw as easily exploitable, and the confidentiality and integrity impact spans the full set of DRM-managed master data used for financial consolidation and reporting.

Critical Impact
Unauthenticated remote attackers can gain full read and write access to all data managed by Oracle Hyperion Data Relationship Management over HTTP.

Affected Products

Oracle Hyperion Data Relationship Management 11.2.26.0.000
Oracle Hyperion (Access and Security component)
Deployments exposing the Hyperion DRM web interface over HTTP or HTTPS

Discovery Timeline

2026-09-15 - CVE-2026-87128 published to the National Vulnerability Database
2026-09-15 - Oracle published Security Alert CSPUSEP2026 addressing the flaw
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87128

Vulnerability Analysis

Oracle Hyperion Data Relationship Management centralizes hierarchies, attributes, and reference data used across enterprise performance management systems. The vulnerability sits in the Access and Security component, which enforces authentication and authorization for DRM users and API consumers. The flaw allows a remote attacker to reach protected functionality without presenting valid credentials.

Because exploitation requires only HTTP network access and no user interaction, any DRM instance reachable from an untrusted network is at risk. The impact covers both confidentiality and integrity of DRM data, but availability is not affected according to Oracle's advisory. Master data corruption in DRM can cascade into downstream Hyperion Financial Management, Planning, and Essbase environments that consume DRM hierarchies.

Root Cause

Oracle classifies the weakness under CWE-287: Improper Authentication. The Access and Security component fails to properly validate the identity of the requester before granting access to DRM operations. Oracle has not published component-level technical detail beyond the advisory. See the Oracle Security Alert CSPUSEP2026 for the authoritative description.

Attack Vector

The attack path is remote and network-based over HTTP. An attacker sends crafted requests directly to the Hyperion DRM web tier, bypassing the authentication check, and then invokes DRM operations such as querying hierarchies, exporting master data, or modifying dimension members. No privileges or user interaction are required, which makes internet-exposed DRM instances immediately reachable targets. Verified public exploit code is not available at the time of publication, and EPSS reflects a low current exploitation probability, though this can change rapidly after vendor disclosure.

No verified public exploit code is available. Refer to Oracle's advisory for further technical context.

Detection Methods for CVE-2026-87128

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to Hyperion DRM endpoints that return 200 OK without a preceding authenticated session.
Unexpected DRM audit log entries showing hierarchy exports, member additions, or deletions performed by anonymous or service accounts.
Outbound data transfers from Hyperion DRM servers to unfamiliar external hosts shortly after inbound HTTP traffic spikes.

Detection Strategies

Enable and centralize DRM application and IIS access logs, then alert on request patterns to /drm-web-client/ or DRM API paths that lack valid session tokens.
Correlate DRM audit changes with authenticated user sessions to identify modifications that cannot be tied to a legitimate operator.
Deploy web application firewall rules or reverse proxy inspection to flag anomalous HTTP methods and payload sizes reaching the DRM front end.

Monitoring Recommendations

Baseline normal DRM user activity by source IP and time-of-day, then alert on deviations after applying the Oracle patch.
Forward DRM host telemetry, IIS logs, and network flow data into a centralized analytics platform for retroactive hunting.
Monitor process and file creation on DRM application servers for artifacts consistent with post-exploitation staging.

How to Mitigate CVE-2026-87128

Immediate Actions Required

Apply the fixes documented in Oracle Security Alert CSPUSEP2026 to every Oracle Hyperion DRM 11.2.26.0.000 deployment.
Remove direct internet exposure of Hyperion DRM until the patch is applied and verified.
Rotate service account credentials and audit DRM administrative accounts for unauthorized changes.
Review DRM audit history for unexplained hierarchy, node, or attribute changes since the vulnerability window opened.

Patch Information

Oracle addressed CVE-2026-87128 in Security Alert CSPUSEP2026, published on 2026-09-15. Administrators should download the applicable patch from My Oracle Support, apply it to affected Hyperion DRM environments, and validate that the Access and Security component reports the updated build after installation. Confirm downstream EPM consumers still authenticate correctly after patching.

Workarounds

Restrict network access to the DRM web tier using firewall rules that allow only trusted management subnets and jump hosts.
Place Hyperion DRM behind an authenticating reverse proxy or VPN gateway that enforces multi-factor authentication before requests reach the application.
Disable or block unused DRM HTTP endpoints at the load balancer or web server layer to reduce exposed attack surface.

bash

# Example: restrict Hyperion DRM web tier access to trusted management subnet
# Windows Firewall rule (run in elevated PowerShell on the DRM host)
New-NetFirewallRule -DisplayName "Hyperion DRM - Allow Mgmt Only" \
  -Direction Inbound -Protocol TCP -LocalPort 80,443 \
  -RemoteAddress 10.10.20.0/24 -Action Allow

New-NetFirewallRule -DisplayName "Hyperion DRM - Block Other" \
  -Direction Inbound -Protocol TCP -LocalPort 80,443 \
  -Action Block